Hi,
I am working on the correct settings for the multiline codec plugin. I want to join all lines between two \r\n
into a single event and it works well, except that blank lines are dropped.
I'm running Logstash v7.16.1 with the following debug setup:
Logstash config:
input {
file {
path => "${SKY_IMPORT_PATH}"
file_completed_action => "log"
file_completed_log_path => "/dev/null"
mode => "read"
exit_after_read => true
file_chunk_size => 100000000000
sincedb_path => "/dev/null"
codec => multiline {
pattern => "\r$"
negate => true
what => "next"
}
}
}
output {
stdout {}
}
Test file:
header\r\n
line1:a\n
b\n
\n
c\n
d\r\n
If I run logstash with multiline codec disabled, it outputs each line as a separate event, as expected, i.e. separate events with the messages header\r
, line1:a
, b
, <empty string>
, c
, d\r
respectively. Note that the blank line is not dropped.
If I run logstash with the multiline codec enabled, it joins the lines as intended except for dropping the blank line.
I get two events with messages header\r
and line1:a\nb\nc\nd\r
but I would expect (and need) the second message to be line1:a\nb\n\nc\nd\r
, i.e. containing the blank line from the test file.
Also, If I add more line breaks into my test file, every group of consecutive \n
is collapsed into a single \n
.
Can somebody help me saving my blank line, please?
Thanks,
Samuel